October Threat Rundown: Credential Theft Takedown, Akira VPN Vuln, Oracle Zero-Day, and more

Microsoft’s Digital Crimes Unit coordinates with Cloudflare to take down a phishing-as-a-service operation, Akira conducts a mass exploitation, a new Oracle zero day and more in our October 2025 Monthly Threat Rundown.

blog

October Threat Rundown: Credential Theft Takedown, Akira VPN Vuln, Oracle Zero-Day, and more

blog

RaccoonO365 PhaaS Takedown

Microsoft’s Digital Crimes Unit has coordinated with Cloudflare and others to seize 338 domains used by the RaccoonO365 phishing‑as‑a‑service operation, which has stolen more than 5,000 Microsoft 365 credentials across 94 countries since July 2024.

Technical summary (TTPs & details):

Initial access: Phishing with brand‑impersonation templates delivered via bulletproof hosting/CDNs
Credential access: Adversary‑in‑the‑middle (AitM) pages & session cookie theft to bypass MFA (T1539: Steal Web Session Cookie; T1556.006: Modify Authentication Process – MFA bypass).
Defense evasion: Fast‑flux domain rotation and domain shadowing across PhaaS infrastructure (T1583.001/003: Acquire infrastructure; T1036: Masquerading).
Exfiltration: Valid account reuse to access M365 and downstream SaaS (T1078: Valid Accounts).

Rubrik backup & recovery insights:

Contain account takeovers: Enforce step‑up MFA and conditional access for Rubrik Security Cloud (RSC) user roles; monitor for anomalous session reuse.
Blast‑radius control: Use Sensitive Data Discovery to scope exfil risk in M365/OneDrive/SharePoint; enable Snapshot Anomaly Detection to flag mass‑access/rename events post‑phish.
Recovery posture: Validate immutable snapshots for M365 mail/SharePoint & on‑prem; test least‑privileged service principals and rotate keys regularly.

Akira Ransomware vs. SonicWall SSL VPNs

Threat actors associated with Akira are conducting opportunistic mass exploitation against SonicWall SSL VPN devices. Initial access aligns with historic abuse of CVE‑2024‑40766. Campaigns show successful OTP‑MFA challenges, then near‑immediate port scans, Impacket SMB activity, and rapid ransomware deployment. Short dwell times (minutes to hours) and campaigns continue to affect victims across multiple sectors and organization sizes.

Technical summary (TTPs & details):

Initial Access: Exploitation of edge appliance vulnerability/reused stolen credentials (VPN) (T1190/T1078)
Defense Evasion: MFA bypass/abuse of OTP (T1556.006), living‑off‑the‑land tools
Lateral Movement: Port scanning, SMB/Impacket (T1046/T1021.002)
Impact: Encrypt/Exfiltrate (T1486/T1041)

Rubrik backup & recovery insights:

Encryption prevention: For VPN‑initiated rapid encryption, ensure MFA on Rubrik login & APIs, Ransomware Monitoring & Investigation is tuned for SMB/Impacket spikes, and Immutable and Anomaly‑aware Snapshots with isolation are enforced.
Access management: Use Service Accounts with least privilege and rotate secrets post‑edge‑device remediation.
Resilience assurance: Validate instant recovery runbooks for AD, hypervisors, and critical file shares.

Oracle E‑Business Suite Zero‑day Exploited by Cl0p

Researchers have discovered a zero-day exploit affecting Oracle E‑Business Suite (EBS) and exploited by the Cl0p ransomware group, leading to data‑theft extortion emails against multiple organizations. Oracle has released an emergency fix and confirmed the incident after earlier notes about July‑patched flaws.

Technical summary (TTPs & details):

Vulnerability: Unauthenticated RCE in Oracle EBS (CVE‑2025‑61882); Oracle confirmed active exploitation and shipped an out‑of‑band fix.
Objective: Data theft and extortion; emails sent to executives claim large ERP dataset exfiltration; actor branding overlaps with Cl0p/FIN11.
Initial access: Likely mix of known July‑patched flaws and the zero‑day; follow‑on access via stolen app creds and session tokens.

Rubrik backup & recovery insights:

Application‑aware ERP protection: Ensure frequent, immutable backups of EBS DB and application tiers, validate redo/archive log capture, and enable anomaly‑based exfil alerts on DB dumps.
Credential blast‑radius control: Store backup secrets out‑of‑band; rotate any app/service creds found in snapshot scans (Sensitive Data Discovery).
Recovery: Stage clean‑room (network‑isolated) rebuilds of EBS; rehearse object‑level restores for HR/Finance; enforce MFA on delete/restore.

Fortra GoAnywhere MFT Zero‑day Exploited

A zero-day exploit affecting Fortra GoAnywhere Managed File Transfer (MFT) solution has been observed being exploited by the threat group known as Storm‑1175 to deploy Medusa ransomware. The vulnerability allows for the creation of backdoor administrator accounts without authentication. The China-based, financially-motivated threat group known as Medusa has been using the exploit since early September, according to researchers.

Technical summary (TTPs & details):

Vulnerability: CVSS 10.0 deserialization → RCE in GoAnywhere MFT (CVE‑2025‑10035).
Exploitation: Microsoft attributes active exploitation to Storm‑1175 with Medusa ransomware outcomes; exploitation may require a private key per reporting; exploitation observed pre‑disclosure.
Initial access & execution: Unauthenticated request to license servlet leads to command injection/RCE on MFT host.
Objectives: Data theft and ransomware deployment via MFT foothold, with the possibility of lateral movement to internal storage/identity infrastructure.

Rubrik backup & recovery insights:

Back up the broker: Treat MFT servers as Tier Zero data brokers. Enforce immutable, high‑frequency snapshots, sensitive data discovery, and egress anomaly alerts on staging paths.
Least‑privilege restores: Separate backup identities; MFA‑gate delete/restore; isolate restores into clean room; validate object‑level recovery for partner‑exchange shares.
Rotate secrets fast: After patching, rotate service creds/API tokens discovered in snapshots; scan backups for leaked secrets.